Dependabot cannot update to a non-vulnerable version

[billinghamj]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

npm

Package manager version

Yarn 3.2.0

Language version

No response

Manifest location and content before the Dependabot update

js/yarn.lock

dependabot.yml content

version: 2

updates:
- package-ecosystem: npm
  directory: "/js"
  schedule:
    interval: daily
  ignore:
  # matched vaguely against Expo's dependency API
  # e.g. https://exp.host/--/api/v2/sdks/46.0.0/native-modules
  - dependency-name: "@react-native-async-storage/async-storage"
  - dependency-name: "@sentry/react-native"
  - dependency-name: "expo-*"
  - dependency-name: "lottie-react-native"
  - dependency-name: "react"
  - dependency-name: "react-dom"
  - dependency-name: "react-native"
  - dependency-name: "react-native-safe-area-context"
  - dependency-name: "react-native-screens"
  - dependency-name: "react-native-svg"
  - dependency-name: "react-native-web"
  - dependency-name: "react-native-webview"
  - dependency-name: "sentry-expo"

Updated dependency

@xmldom/xmldom is currently on 0.7.5

It should be updated to 0.7.6

What you expected to see, versus what you actually saw

Dependabot should have opened a PR updating @xmldom/xmldom to 0.7.6

Instead, it claims it's not able to, but there's nothing preventing this in the required resolutions

Native package manager behavior

Running yarn up -R @xmldom/xmldom works great, no problem:

Images of the diff or a link to the PR, issue, or logs

Private, but fine for GH staff to look at it:

• https://github.com/wearemojo/mojo/security/dependabot/101
• https://github.com/wearemojo/mojo/security/dependabot/101/update-logs/275815839

updater | INFO <job_487160402> Checking if @xmldom/xmldom 0.7.5 needs updating
  proxy | 2022/10/19 17:44:38 [016] GET https://registry.npmjs.org:443/@xmldom%2Fxmldom
  proxy | 2022/10/19 17:44:38 [016] 200 https://registry.npmjs.org:443/@xmldom%2Fxmldom
  proxy | 2022/10/19 17:44:38 [018] GET https://registry.npmjs.org:443/@xmldom%2Fxmldom/0.8.3
  proxy | 2022/10/19 17:44:38 [018] 200 https://registry.npmjs.org:443/@xmldom%2Fxmldom/0.8.3
  proxy | 2022/10/19 17:44:41 [058] GET https://registry.yarnpkg.com:443/@xmldom%2fxmldom
  proxy | 2022/10/19 17:44:41 [058] 200 https://registry.yarnpkg.com:443/@xmldom%2fxmldom
  proxy | 2022/10/19 17:45:02 [046] GET https://registry.yarnpkg.com:443/@xmldom%2fxmldom
  proxy | 2022/10/19 17:45:02 [046] 200 https://registry.yarnpkg.com:443/@xmldom%2fxmldom
  proxy | 2022/10/19 17:45:16 [247] GET https://registry.npmjs.org:443/@xmldom%2Fxmldom/0.7.6
  proxy | 2022/10/19 17:45:16 [247] 200 https://registry.npmjs.org:443/@xmldom%2Fxmldom/0.7.6
updater | INFO <job_487160402> The latest possible version of @xmldom/xmldom that can be installed is 0.7.5

Smallest manifest that reproduces the issue

No response

[billinghamj]

Important note: the Yarn v2 flag is enabled for our repo ⚠️

@jurre Tagging you as requested 😊

[pavera]

I'll take a look at this @billinghamj. I'm actually setting up a test based on a similar issue from last week. Hopefully I can run it to ground quickly.

[pavera]

I'm able to successfully recreate this by including a private package that isn't available on registry.npmjs.org or registry.yarnpkg.com. Looking at the logs it appears this is the state your repo is in as well. I'm now investigating the exact cause of the failure.

[billinghamj]

Nice, thank you!

Yeah we have several packages within our monorepo/Yarn workspace

[pavera]

I've got a fix #5930 I'm getting ready to deploy. It still requires that any private registries be correctly configured or the update will fail, but previously even with correct configuration the update would fail.

[pavera]

@billinghamj I've deployed the above fix now, could you give it another try and see what the result is?

[billinghamj]

@pavera Sorry, we manually updated yesterday as it was a security alert

[pavera]

In that case, I'll go ahead and close this, feel free to re-open it if another security alert comes up and we fail to provide a PR.